[Last Updated June 2026]
1. Who we are (Data Controller)
The controller responsible for the processing of your personal data is:
VYNCY — Liz Vyncy Königsallee 27, 40212 Düsseldorf, Germany Email: support@vyncy.com
This Privacy Policy explains how we process personal data across our websites and services: vyncy.com and its sub-areas (including ecotech.vyncy.com), the store at store.vyncy.com, and the VYNCY Academy at academy.vyncy.com (together, the "Sites"). It applies under the EU General Data Protection Regulation (GDPR) and applicable German data protection law. We collect only the data we need, and we do not sell your personal data.
2. What data we collect
(a) Data you provide directly — when you create an account, make a purchase, subscribe to our list, or contact us: your name, email address, billing address, the content of your messages, and any information you choose to give us. Payment details are processed by our payment providers; we do not store your full card details.
(b) Data collected automatically — when you visit the Sites: IP address, date and time of access, pages and files requested, browser type and version, device and operating system, referring URL, and security and error logs.
(c) Data collected through purchases — when you buy a product or membership, our payment providers collect the information needed to complete the transaction. This is processed directly by them and is not stored on our systems.
3. How we use your data, and our legal bases
To operate and secure the Sites — legitimate interest, Art. 6(1)(f) GDPR.
To provide what you have purchased (accounts, access to digital products and memberships, downloads) and to handle billing and renewals — performance of a contract, Art. 6(1)(b) GDPR.
To respond to your enquiries — Art. 6(1)(b) where pre-contractual or contractual, otherwise legitimate interest Art. 6(1)(f).
To send marketing emails, only with your consent — Art. 6(1)(a) GDPR; you may withdraw consent at any time via the unsubscribe link or by emailing support@vyncy.com.
To improve our content and services through usage analysis — legitimate interest, Art. 6(1)(f); where this uses non-essential cookies, only with your consent.
To meet legal, tax, and accounting obligations — legal obligation, Art. 6(1)(c) GDPR.
4. Service providers (processors)
We use the following providers to run the Sites. Each acts as a processor on our behalf under Art. 28 GDPR, or as an independent controller where noted. Some are based in the United States.
Showit — website platform and hosting for vyncy.com (and ecotech.vyncy.com). Privacy: showit.com/privacy-policy
Shopify — e-commerce platform, checkout, and hosting for store.vyncy.com (Shopify International Ltd. / Shopify Inc.). Privacy: shopify.com/legal/privacy
Kajabi — course and membership platform, accounts, checkout, hosting, and student and account emails (including member newsletters) for academy.vyncy.com (Kajabi LLC, USA). Privacy: kajabi.com/policies/privacy
Payment providers — Stripe, PayPal, Apple Pay, and Shopify Payments for the store; Kajabi Payments (powered by Stripe) for the academy. These process your payment data directly as independent controllers. Stripe: stripe.com/privacy · PayPal: paypal.com privacy
Flodesk — our newsletter sign-up forms and marketing email delivery (Flodesk Inc., USA). Privacy: flodesk.com/privacy
Plausible Analytics — privacy-friendly website analytics. Plausible is cookieless: it sets no cookies and collects no personal data or cross-site identifiers, and is used only to understand site usage in aggregate (Plausible Insights OÜ, EU-hosted). Privacy: plausible.io/privacy. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
If we add further tools in future (e.g., a community or support platform), we will update this policy.
5. International data transfers
Some providers (e.g., Shopify, Kajabi, Stripe, PayPal, Flodesk) may process data in the United States or other countries outside the EEA. Where this occurs, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or a recognised data-protection framework. For details of the safeguards for a specific transfer, contact support@vyncy.com.
6. Data retention
We keep personal data only as long as necessary for the purposes above. Account and purchase data is kept while your account is active and you have access to what you bought; on account deletion it is removed within 30 days, subject to legal retention. Transaction and billing records are kept for the periods required by German tax and commercial law (up to 10 years under § 257 HGB and § 147 AO). Marketing data is kept until you unsubscribe, with a minimal suppression record retained to honour your opt-out. Server and security logs are deleted or anonymised after a short period.
7. Cookies and similar technologies (TDDDG)
The Sites use cookies and similar technologies. Essential cookies (security, login sessions, cart, basic settings) are necessary for the Sites to function and are used on the basis of legitimate interest, Art. 6(1)(f) GDPR. Any non-essential cookies are set only with your consent, in line with the German TDDDG. On the academy (academy.vyncy.com) we manage cookie consent through CookieScript; on the store (store.vyncy.com) consent is managed through Shopify's customer-privacy settings. Our website analytics (Plausible) is cookieless and sets no cookies, so it requires no consent. You can manage your choices through the consent banner where shown, or through your browser; blocking essential cookies may impair the Sites.
8. Your rights under the GDPR
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object to processing based on legitimate interest and to direct marketing at any time (Art. 21), and to withdraw consent at any time without affecting prior lawful processing (Art. 7(3)). To exercise any right, email support@vyncy.com; we respond within one month.
9. Right to complain
You may lodge a complaint with a supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Postfach 20 04 44, 40102 Düsseldorf, Germany — www.ldi.nrw.de
10. Security
We use appropriate technical and organisational measures to protect your data, including encrypted transmission (SSL/TLS), secure hosting through our platforms, and access controls. No method of internet transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children
The Sites are not directed at children under 16, and we do not knowingly collect their data. The VYNCY Kids materials are purchased and accessed by parents or guardians; children do not create accounts. If you believe a child under 16 has given us data, email support@vyncy.com and we will delete it.
12. Other websites
Our Sites may link to one another and to external platforms (e.g., Instagram, Spotify). Those platforms process data under their own policies. This Privacy Policy governs only the VYNCY Sites listed in Section 1.
13. Changes
We may update this Privacy Policy to reflect changes in our services or the law. The "Last updated" date shows the current version.
14. Contact
For any privacy request: support@vyncy.com — VYNCY, Liz Vyncy, Königsallee 27, 40212 Düsseldorf, Germany.
